CampaignPublished 3 Sep 2025

Analyzing NotDoor: Inside APT28's Expanding Arsenal

Source AlienVault OTX General

Description

LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.

Impact

For European organizations, especially those within NATO member states, NotDoor poses a significant espionage and operational risk. The malware's ability to monitor Outlook emails and selectively activate on trigger words allows targeted infiltration of high-value individuals and departments, such as defense, foreign affairs, and critical infrastructure operators. Data exfiltration capabilities threaten the confidentiality of sensitive government communications and classified information. The ability to upload and execute arbitrary commands can lead to lateral movement within networks, potentially compromising additional systems and enabling further espionage or sabotage. The use of DLL side-loading via a trusted Microsoft executable complicates detection, increasing the likelihood of prolonged undetected presence. This could result in significant operational disruption, loss of intellectual property, and exposure of strategic plans. The persistence mechanism ensures that even after system restarts, the threat remains active, increasing the difficulty of eradication. Given the geopolitical tensions involving Russia and NATO countries, this malware could be part of broader cyber espionage campaigns aimed at undermining European security and defense capabilities.

Defensive guidance

To mitigate the NotDoor threat, European organizations should implement a multi-layered defense strategy tailored to the specific tactics used by this malware. First, restrict or disable VBA macros in Outlook unless explicitly required and signed by trusted publishers. Employ application whitelisting to prevent unauthorized DLLs from loading via legitimate executables like OneDrive.exe. Monitor and audit registry key changes related to persistence mechanisms, particularly those associated with user startup and system services. Deploy advanced endpoint detection and response (EDR) solutions capable of detecting DLL side-loading and anomalous process behaviors. Implement network monitoring to detect unusual outbound traffic patterns indicative of data exfiltration. Use threat intelligence feeds to update detection signatures with the provided file hashes and indicators of compromise. Conduct regular phishing awareness training to reduce the risk of initial infection via email. Finally, enforce strict access controls and network segmentation to limit lateral movement if a system is compromised.

Indicators of compromise

Hashes 5

15e9255a3e3401e5f6578d2ac45b7850
3b80a13199564e3d8a9d26e14defabee136638f8
5a88a15a1d764e635462f78a0cd958b17e6d22c716740febc114a408eef66705
8f4bca3c62268fff0458322d111a511e0bcfba255d5ab78c45973bd293379901
fcb6dc17f96af2568d7fa97a6087e4539285141206185aec5c85fa9cf73c9193

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Sep 2025, 20:03 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Hashes 5

Community reviews

Related threats